We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2023-27987

Apache Linkis gateway module token authentication bypass



Description

In Apache Linkis <=1.3.1, due to the default token generated by Linkis Gateway deployment being too simple, it is easy for attackers to obtain the default token for the attack. Generation rules should add random values. We recommend users upgrade the version of Linkis to version 1.3.2 And modify the default token value. You can refer to Token authorization[1] https://linkis.apache.org/docs/latest/auth/token https://linkis.apache.org/docs/latest/auth/token

Reserved 2023-03-09 | Published 2023-04-10 | Updated 2024-10-17 | Assigner apache

Problem types

CWE-326 Inadequate Encryption Strength

Product status

Default status
unaffected

Any version
affected

Credits

Laihan reporter

References

lists.apache.org/thread/3cr1cz3210wzwngldwrqzm43vwhghp0p vendor-advisory mailing-list

www.openwall.com/lists/oss-security/2023/04/10/3

cve.org (CVE-2023-27987)

nvd.nist.gov (CVE-2023-27987)

Download JSON

Share this page
https://cve.threatint.eu/CVE/CVE-2023-27987

Support options

Helpdesk Chat, Email, Knowledgebase